# Tampered Claude Code Extension Hit Up to 5,000 Cursor Users

URL: https://3ammarketer.com/news/claude-code-extension-backdoor-cursor
Published: 2026-11-02

> A compromised Claude Code extension on the Cursor marketplace exposed 5,000 developer workstations to SSH backdoors and data harvesting on October 29, 2026.

Cursor reported that around 5,000 developer systems were impacted after an auto-updated version of Anthropic's Claude Code extension planted a remote access backdoor on October 29, 2026. [1][2][4]

![A screenshot of the Cursor security notice announcing the malicious extension incident.](https://dygolixznokmekyvajbb.supabase.co/storage/v1/object/public/images/content/a56095da466710613d12582a.png)

## Network IOCs and the svc-telemetry key

The malicious payload communicates via HTTP POST requests to a beacon located at 134[.]209[.]82[.]225:8099/beacon. It then attempts to establish a persistent reverse SSH tunnel to 134[.]209[.]82[.]225 on port 22. [1]

During execution, the malware gathers developer data including hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email, and public IP. To enable inbound SSH access, the code appends an attacker-controlled Ed25519 public key labeled with the comment 'svc-telemetry' into the user's ~/.ssh/authorized_keys file, setting restrictive directory and file permissions. [1][3]

![A screenshot of the Phorion security advisory detailing the Claude Code extension compromise.](https://dygolixznokmekyvajbb.supabase.co/storage/v1/object/public/images/content/127678f2d71e1c09cfaa5162.png)

## LaunchAgent and SysMon persistence mechanics

The extension installs platform-specific persistence mechanisms across macOS, Linux and Windows developer workstations. On macOS endpoints, the malware deploys a LaunchAgent configured at ~/Library/LaunchAgents/com.apple.sysmond.plist. On Windows machines, the installer registers a scheduled task named 'SysMon' designed to execute with SYSTEM privileges, alongside a fallback script named sysmon.cmd placed directly inside the user's Startup folder. [2]

The backdoor attempts to enable macOS remote login through the systemsetup command. However, because it runs under standard user permissions, systemsetup prints an administrator-access error and exits without turning on the local SSH daemon. [3]

## Incident response and remediation checklist

First, inspect ~/.ssh/authorized_keys and purge any public key entry ending with the 'svc-telemetry' comment. Second, terminate network traffic directed to 134[.]209[.]82[.]225 on port 22 and port 8099. Third, kill any running ssh or autossh tunnel to that address, then remove ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS, the @reboot cron entry on Linux, or the SysMon scheduled task and sysmon.cmd Startup script on Windows, along with the hidden ~/.config/.smt and ~/.config/.smtk files on macOS and Linux. Finally, verify that Claude Code in Cursor is updated to replace the compromised release, and rotate all environment variables exposed on affected endpoints. [1][2][3]

Our read: Treat every machine running the compromised Claude Code extension during the incident window as fully compromised. Uninstalling or updating the extension does not remove the backdoor: manually purge the svc-telemetry key from authorized_keys and rotate every API secret stored in local environment variables.

Limit: The sources report that the local SSH daemon activation failed on macOS under standard user privileges, but they do not confirm whether outbound reverse SSH tunnels succeeded through enterprise firewalls on port 22.

## Sources

1. [Anthropic hacked via Cursor to deliver remote access trojan to Claude developer laptops worldwide](https://doublepulsar.com/anthropic-hacked-to-deliver-remote-access-trojan-to-claude-developer-laptops-worldwide-1148a92baae2)
2. [Tampered Claude Code Extension: SSH Backdoor | Focused Hunts](https://www.focusedhunts.com/blog/hunting/Tampered-Claude-Code-Extension-SSH-Backdoor)
3. [Official Claude Code Extension Compromise: Security Advisory | Phorion](https://phorion.io/blog/offical-claude-code-vsx-compromise/)
4. [Instagram](https://www.instagram.com/reel/DfLiKNUDMDW/)